CVE-2014-7839

RESTeasy: External entities expanded by DocumentProvider

Published Nov 25, 2014 CVSS 2.0 · 6.4 Medium EPSS 2.0% KEV · Not listed
Description
DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-4739 DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
Github GHSA Github GHSA GHSA-pc54-pchm-xcw6 XML External Entity Reference in RESTEasy
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 1:03 PM
Reserved
Oct 3, 2014, 12:00 AM
Status
Modified
Published
Nov 25, 2014, 3:59 PM
Modified
Jun 17, 2026, 12:15 AM
Severity
Moderate
Public date
Nov 18, 2014, 12:00 AM